Structured logging system

Abstract

The described technology is directed towards a structured logging technology in which events corresponding to program execution are received in a structured format and logged based upon filtering of those events. A log handler is associated with a filtering mechanism that determines whether each event matches filtering criteria and is thus to be logged by the log handler. The log handler provides matching logged events to an event sink, such as an analytic tool that consumes the events for analysis.

What is claimed is: 
     
       1. A system, comprising:
 an event logger that receives event log entries that correspond to events generated during an execution of a program; and 
 a server component that:
 determines a quantity of log handlers to employ for the program based on a determination of a rarity of a bug in the program, and 
 selects one or more log handlers from a set of log handlers to meet the quantity of log handlers, each log handler configured to process event log entries that correspond to program execution, wherein the one or more log handlers comprise a first log handler having an associated filtering mechanism that selects only event log entries matching a specified set of one or more criterion to provide filtered event log entries, and first log handler data configured to provide data corresponding to the filtered event log entries to an event sink associated with the first log handler, wherein the event log entries comprise event information represented via a defined data structure comprising two or more fields, and wherein the one or more log handlers are selected from the set of log handlers at runtime based on a classification of a device that is utilized to execute the program. 
 
 
     
     
       2. The system of  claim 1 , wherein the filtering mechanism includes at least one regular expression for string matching. 
     
     
       3. The system of  claim 1 , wherein the filtering mechanism includes at least two filters in a pipeline configuration. 
     
     
       4. The system of  claim 1 , wherein the filtering mechanism includes a conditional filter. 
     
     
       5. The system of  claim 1 , wherein the event log entries include streaming video playback activity events. 
     
     
       6. The system of  claim 1 , wherein the event log entries include at least one of: user activity events, diagnostics information, tracing data or performance counter data. 
     
     
       7. The system of  claim 1 , wherein the event log entries include user achievement events related to a gaming service. 
     
     
       8. The system of  claim 1 , wherein the first log handler reformats the log entries to provide the data corresponding to the filtered event log entries to the event sink. 
     
     
       9. The system of  claim 1 , wherein the one or more log handlers are selected at runtime further based upon a version of the program. 
     
     
       10. The system of  claim 7 , wherein the user achievement events comprise information indicative of at least one of a time period for which a game has been played, a level in the game reached by a player, game statistics, or an award won by a player in a game. 
     
     
       11. The system of  claim 1 , wherein the one or more log handlers are selected at runtime further based upon defined timing data. 
     
     
       12. The system of  claim 1 , wherein the classification of the device comprises a vendor identity of a vendor of the device. 
     
     
       13. The system of  claim 1 , wherein the fields comprise a type information field and a data payload, in which data in the data payload is dependent on the type information. 
     
     
       14. The system of  claim 13 , wherein the fields further include at least one of: an area field indicative of at least a portion of an application that creates an event log entry of the event log entries, or a verbosity field indicative of a priority level of the log entry. 
     
     
       15. A method implemented at least in part on at least one machine, comprising:
 receiving structured events that are generated during an execution of a program and comprise event log data represented via a defined data structure that comprises a first field indicative of a type of event and a second field indicative of the event data payload; 
 determining a quantity of log handlers to employ for the program based on a determination of a rarity of a bug in the program; 
 selecting one or more log handlers from a set of log handlers at runtime of the program to meet the quantity of log handlers and based on type data indicative of a type of a device that executes the program, wherein the one or more log handlers are employable to process the structured events; 
 employing the one or more log handlers to facilitate filtering the events based upon type information within the first field to obtain only filtered events specified by the one or more log handlers; and 
 outputting data corresponding to the filtered events to at least one event sink. 
 
     
     
       16. The method of  claim 15 , wherein the selecting comprises selecting, at runtime, the one or more log handlers further based upon program data indicative of a version of the program. 
     
     
       17. The method of  claim 15 , wherein the employing the one or more log handlers comprises employing a filtering mechanism comprising a regular expression-based filter, a conditional filter or a filter pipeline, or any combination of a regular expression-based filter, a conditional filter or a filter pipeline to filter the structured events. 
     
     
       18. The method of  claim 15 , wherein outputting data corresponding to the filtered events to at least one event sink comprises caching data in a cache, and flushing the cache upon meeting at least one cache flushing criterion. 
     
     
       19. One or more machine-readable media having machine-executable instructions, which when executed perform steps, comprising:
 receiving structured events that are generated during an execution of a program and comprise event log data represented via a defined data structure that comprises a first field indicative of a type of event and a second field indicative of the event data payload; 
 determining a quantity of log handlers to employ for the program based on a determination of a rarity of a bug in the program; 
 selecting one or more log handlers from a set of log handlers at runtime of the program to meet the quantity of log handlers and based on type data indicative of a type of a device that executes the program, wherein the one or more log handlers are employable to process the structured events; 
 employing the one or more log handlers to facilitate filtering the events based upon type information within the first field to obtain only filtered events specified by the one or more log handlers; and 
 outputting data corresponding to the filtered events to at least one event sink. 
 
     
     
       20. The one or more machine-readable media of  claim 19 , wherein the selecting comprises selecting, at runtime, the one or more log handlers further based upon program data indicative of a version of the program.